Voters Fail Mock Election, Exposing Vulnerability to Hackers

(Bloomberg) -- There’s a secret weapon in America’s battle to secure the 2020 vote from nation-state hackers: the voters. But there’s a problem. Only a few of them are in on the secret.

Many voters across the country will cast ballots this year on machines called ballot-marking devices, which attempt to marry the convenience of touchscreen technology with an auditable paper trail. To ensure that these BMDs accurately translate each voter’s choices from screen to paper, voters must verify summary receipts or ballot cards to identify errors, if they exist.

Yet only 6.6% of voters in a mock Michigan election discovered mistakes -- like a vote for a candidate they hadn’t selected -- that were deliberately introduced into the machines to mimic the work of a hacker. Only 40% of participants bothered to check the ballots without being prompted, according to a report published Wednesday by the University of Michigan called “Can Voters Detect Malicious Manipulation of Ballot Marking Devices.”

States and local jurisdictions across the country are embracing these voting machines, which proponents say provide a paper trail that catches computer errors -- or hacks -- before a winner is declared. South Carolina and Georgia -- accounting for about 9 million voters -- have adopted BMDs. So have several counties in Pennsylvania, and Los Angeles County, the largest election jurisdiction in the U.S.

The Michigan study determined that these largely unproven machines carry risks and vulnerabilities capable of undermining the integrity of elections in 2020. If any are infected with malware, the paper trail designed to verify results could be corrupted, allowing cheating in the election to go undetected, according to the report.

The study asked 241 eligible voters to cast ballots at a pair of Ann Arbor libraries on three BMDs over three days in July and September. Voters were told they were participating in a study to assess the “usability of a new type of voting machine,” according to the report.

The voters made their selections on the screens and printed their ballots before walking over to a scanner a few feet away. What they didn’t know was that their ballots included at least one intentional error and that surveyors were watching to see how many voters would check their ballots before formally submitting them.

When unprompted, more than 93% of voters didn’t catch a mistake despite checking the ballot, apparently putting their faith in the computer to protect their vote. In at least one case, voters who found mistakes blamed themselves instead of the machine.

“I don’t remember voting for the member of Congress and there was a vote” on the paper ballot, said one voter, according to the report. “I may have but just don’t remember.”

The study tried multiple techniques to remind voters, including signs in the polling place and verbal cues. The findings improved when poll workers prompted voters to check their ballots. For instance, every voter reviewed their ballot once informed that the paper records were the “official record” of their vote. But even then, only 38.5% of voters found the mistakes in their ballots, too low a rate to alert precinct workers of a system-wide problem requiring intervention, according to the report.

The report acknowledges that BMDs do have benefits. They are better than having no paper trail and assist voters with disabilities. But they also require further evaluation before being used as the primary method of voting, as will be the case in jurisdictions across the country in 2020, said J. Alex Halderman, a computer science professor at the University of Michigan.

“Technology in voting is very popular; only a small number of voters understand the risk of hacking,” said Halderman, an author of the report. “I don’t think we’re too flawed as a species to execute democracy, but we need to use the tools that are available to us that ensure the credibility of our results. BMDs have not been proved to be safe and effective.”

To contact the reporter on this story: Kartikay Mehrotra in San Francisco at kmehrotra2@bloomberg.net

To contact the editors responsible for this story: Andrew Martin at amartin146@bloomberg.net, Robin Ajello

©2020 Bloomberg L.P.